NVR DVR - RCE (CVE-2021-41419)
Description
QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.
psychologyCrowdSec Analysis
CVE-2021-41419 is a critical remote code execution vulnerability in QVIS NVR DVR devices prior to 2021-12-13, stemming from insecure Java deserialization. Attackers can exploit this flaw remotely to execute arbitrary code, potentially taking full control of affected systems and compromising confidentiality, integrity, and availability.
CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-41419 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending crafted requests to endpoints under /qvisdvr/, specifically targeting /qvisdvr/index.faces with malicious Java deserialization payloads in the javax.faces.ViewState parameter to achieve remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-07-17 |
| Rule Released | 2025-11-26 |
| CrowdSec First Seen | 2026-02-01 |
Remediation & Protection
External References
- https://gist.github.com/Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/712ac36c8a08e2698e875169442a23a4
- https://github.com/projectdiscovery/nuclei-templates/blob/master/iot/qvisdvr-deserialization-rce.yaml
- https://twitter.com/Me9187/status/1414904314368348163
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41419.yaml